一种基于RBAC的电子商务匿名性与可追究性实现方案

提出了一种基于RBAC思想对可信第三方功能进行分类并结合其他一些技术实现电子商务中匿名性与可追究性的解决方案，主要涉及三个主要过程：用户的注册控制、交易过程的控制及投诉处理过程。通过对注册用户的信息进行加密并对加密密钥进行分割保存来实现匿名性，通过对交易过程安全协议的设计及TTP功能的划分达到可追究性要求，并对可追究性的实现给予证明。

Layered Architecture for Secure E-Commerce Applications

We present a layered architecture for secure e-commerce applications and protocols with fully automated dispute-resolution process, robust to communication failures and malicious faults. Our design is modular, with precise yet general-purpose interfaces and functionalities, and allows usage as an underlying secure service to different e-commerce, e-banking and other distributed systems. The interfaces support diverse, flexible and extensible payment scenarios and instruments, including direct buyer-seller payments as well as (the more common) indirect payments via payment service providers (e.g. banks). Our design is practical, efficient, and ensures reliability and security under realistic failure and delay conditions.

RSA-Based Password-Authenticated Key Exchange, Revisited

The RSA-based Password-Authenticated Key Exchange (PAKE) protocols have been proposed to realize both mutual authentication and generation of secure session keys where a client is sharing his/her password only with a server and the latter should generate its RSA public/private key pair (e, n), (d, n) every time due to the lack of PKI (Public-Key Infrastructures). One of the ways to avoid a special kind of off-line (so called e-residue) attacks in the RSA-based PAKE protocols is to deploy a challenge/response method by which a client verifies the relative primality of e and φ(n) interactively with a server. However, this kind of RSA-based PAKE protocols did not give any proof of the underlying challenge/response method and therefore could not specify the exact complexity of their protocols since there exists another security parameter, needed in the challenge/response method. In this paper, we first present an RSA-based PAKE (RSA-PAKE) protocol that can deploy two different challenge/response methods (denoted by Challenge/Response Method1 and Challenge/Response Method2). The main contributions of this work include: (1) Based on the number theory, we prove that the Challenge/Response Method1 and the Challenge/Response Method2 are secure against e-residue attacks for any odd prime e; (2) With the security parameter for the on-line attacks, we show that the RSA-PAKE protocol is provably secure in the random oracle model where all of the off-line attacks are not more efficient than on-line dictionary attacks; and (3) By considering the Hamming weight of e and its complexity in the RSA-PAKE protocol, we search for primes to be recommended for a practical use. We also compare the RSA-PAKE protocol with the previous ones mainly in terms of computation and communication complexities.

一个特殊的安全双方计算协议

安全多方计算是近几年国际密码学界研究的一个热点问题。基于Φ-隐藏假设及同态公钥加密体制的语义安全性假设,给出了一个特殊的安全双方计算协议--保密比较协议,该协议同时确保公平性、安全性、有效性和顽健性,并使用安全多方计算对安全性的严格定义,对协议的正确性与安全性进行了证明。与先前工作相比,本文的方案更富有公平性、有效性和安全性。该文在网上投标、拍卖、电子选举等领域中有着广阔的应用前景。

cryptanalysis of the end-to-end security protocol for mobile communications with end-user identification/authentication

IEEE Computer Society

安全网络数学计算协议

讨论了网络数学计算框架IAMC的安全性问题,给出了一个用安全协议SSL/TLS提高数学计算协议MCP安全性的实现方案.改进后的网络数学计算框架可有效地提供计算数据的机密性、完整性和用户认证等安全功能。

基于单向陷门函数的TMN协议的改进

提出了一种利用陷门单向函数的性质对TMN协议进行改进的一般形式，利用串空间理论证明了它的安全性，并给出了几个具体的实现形式。